CVE-2026-13490— GLPI 授权问题漏洞

glpi-project glpi Document document.send.php canViewFile authorization

A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to authorization bypass. The attack can be executed remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

通过用户控制密钥绕过授权机制

GLPI 授权问题漏洞

GLPI是法国GLPI组织开源的一款开源IT和资产管理软件。该软件提供功能全面的IT资源管理接口,你可以用它来建立数据库全面管理IT的电脑,显示器,服务器,打印机,网络设备,电话,甚至硒鼓和墨盒等。 GLPI 11.0.5版本、11.0.6版本和11.0.7版本存在授权问题漏洞，该漏洞源于Document Handler组件中front/document.send.php文件的Document::canViewFile函数对参数docid操作不当，导致授权绕过。

N/A

N/A